Puppet Server includes a file server for transferring static file content to agents; this is what’s used whenever a file resource has a source => puppet:///... attribute specified.

Generally, files are stored in modules. But if you need to serve larger files that shouldn’t be in source control or shouldn’t be distributed with a module, you can make a custom file server mount point and let Puppet serve those files from another directory.

Summary

To create a new mount point, you must:

Choose a directory on disk for the mount point. Make sure Puppet Server can access it, and put files in it as needed.

Edit fileserver.conf on your Puppet Server node, so Puppet knows which directory to associate with the new mount point.

If you want to restrict which nodes can access this mount point, edit auth.conf.

Once the mount point is working, you can reference its files like puppet:///<MOUNT POINT>/<PATH>.

What’s a mount point, in a Puppet URI?

Puppet URIs are constructed like this:

puppet://<SERVER>/<MOUNT POINT>/<PATH>

<SERVER> is optional, which is why you usually see puppet:/// URIs with three slashes. There’s little reason to specify a server, since the default is almost always what you want. (It’s the value of the server setting in Puppet agent, and a special mock server with a modules mount point in Puppet apply.)

<MOUNT POINT> is a unique identifier for some collection of files. There are basically three kinds:

Custom mount points correspond to an arbitrary directory. The rest of this page is about these.

The special modules mount point serves files from the files directory of every module. It behaves as if someone had copied the files directory from every module into one big directory, renaming each of them with the name of their module. (So the files in apache/files/... are available at puppet:///modules/apache/..., etc.)

The special plugins mount point serves files from the lib directory of every module. It behaves as if someone had copied the contents of every lib directory into one big directory, with no additional namespacing. Puppet agent uses this mount point when syncing plugins before a run, but there’s no reason to use it in a file resource.

<PATH> is the remainder of the path to the file, starting from the directory (or imaginary directory) that corresponds to the mount point.

Creating a new mount point in fileserver.conf

fileserver.conf uses an INI-like syntax. The fileserver.conf page has a complete description, but all you need to know is:

Caution: You should always restrict write access to mounted directories. The file server will follow any symlinks in a file server mount, including links to files that agent nodes should not access (like SSL keys).

When following symlinks, the file server can access any files readable by Puppet Server’s user account.

Controlling access to a custom mount point in auth.conf

By default, any node with a valid certificate can access the files in your new mount point — if it can fetch a catalog, it can fetch files; if it can’t, it can’t. This is the same behavior as the special modules and plugins mount points.

If necessary, you can restrict access to a custom mount point in auth.conf.